Security
Encryption at rest and in transit, SOC 2 Type II (in progress), GDPR with EU residency, HIPAA BAA on Enterprise, region pinning, and customer-managed keys. Independent proof is our goal, and we'll publish it as it lands.
In short
Security claims, grounded
Planoda is pre-launch — the controls below describe our target security posture. Items marked in progress or at launch are not yet generally available; SOC 2 attestation is targeted for Q4 2026.
Encryption
AES-256-GCM
Transport
TLS 1.3
Audits
SOC 2 (in progress)
Regions
US-East · EU-West
Uptime
99.9% target
Disclosure
Coordinated
AES-256-GCM for data at rest on every Neon Postgres branch, every S3 bucket, every Upstash Redis namespace. TLS 1.3 (with HSTS preload, OCSP stapling, and TLS-1.2 disabled) for every byte in transit. Field-level encryption for tokens, signing keys, and PII columns — keys live in AWS KMS, never in application memory longer than a single request.
Our Type II observation window is being established, targeting attestation in Q4 2026, against the trust services criteria for Security, Availability, and Confidentiality. We are standing up continuous, automated control monitoring — controls mapped, evidence collected automatically, and drift alerted to the security team. The report will be available to Business + Enterprise customers under NDA from the trust center once attestation completes.
EU data residency on the EU-West region (Frankfurt + Dublin). A Data Processing Agreement will be offered to every paid customer. Right-to-be-forgotten is designed to be honored within 30 days via a self-serve workspace deletion flow that cascades through every storage tier, including backups within 35 days. DPO reachable at privacy@planoda.com.
Business Associate Agreement available on Enterprise plans. PHI is stored only in HIPAA-eligible regions, audit logged on read + write, and segregated by workspace using Postgres Row-Level Security. We plan to commission third-party penetration testing, and we plan to run a coordinated disclosure program (rewards for verified findings at launch).
Pick US-East or EU-West at workspace creation. The choice is permanent and enforced at the database, storage, AI gateway, and CDN edge layers. Cross-region replication is opt-in and explicit — no workspace data ever leaves its chosen region without an admin-signed export action that lands in the audit log.
Enterprise can bring their own AWS KMS key for envelope encryption of every encrypted column and every S3 object. Revoke the key and your workspace is cryptographically unreadable within seconds. Key-usage events stream to your CloudTrail so you have an independent record of every decrypt operation we perform on your behalf.
Every query runs inside a session-pinned transaction enforced by Postgres Row-Level Security. Application bugs cannot bypass tenant boundaries — the database itself refuses. We share the policy SQL on request; auditors love it, customers sleep easier, and it's the control our on-call rotation will rely on most.
Go deeper
Article
As AI agents move from suggesting to acting inside your work platform, 'who approved this?' stops being a nice-to-have and becomes a compliance question. A practical look at why propose-and-approve, immutable audit trails, and per-workspace cost control are becoming table stakes.
Article
An AI agent that can change your data needs more than a kill switch. Here's the propose-and-approve broker model — per-action review, immutable audit, and a cost ledger — that lets agents do real work while a human stays accountable for every consequential change.
Article
Notion turned its workspace into a hub that orchestrates outside agents, governed by admin gatekeeping and per-agent credit limits. Planoda governs the other way — per-action propose-and-approve. Here's why the unit of control matters more than the orchestration layer.
Article
Every team rushing AI into their product has reopened a class of vulnerability we thought we'd solved. Most AI tools are wide open. The defense is old, boring, and entirely ignored.
Article
Row-level security, SSO/SAML, SCIM, and an immutable audit log — the controls that turn a multi-week security review into a one-day sign-off.
Method
An AI teammate you can't see is a liability. One that proposes, waits for a yes, and writes down what it did is leverage. The line is governance.
Security review